Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments.

More precisely, an application can be vulnerable when all the following are true:

• the application is using Spring MVC or Spring WebFlux
• the application is sending view fragments to clients over Server Sent Events (SSE)
• the attacker must have control over data that will be streamed to other users of the application

When all the conditions above are met, the attacker might corrupt the stream of data sent to other users. Depending on the frontend application logic, this could corrupt state or present malicious information to other users.